Information Security Policy

1. Ownership and review

The company administrator owns this policy and is responsible for enforcing it. It is reviewed at least once a year and whenever there is a significant system change or an incident.

2. Data classification

• Confidential: marketplace access credentials (OAuth tokens), passwords, system keys and secrets.
• Restricted: each seller’s operational data, such as orders, amounts, costs, expenses and inventory.
• Internal: technical logs and documentation.
• Public: the website and marketing materials.

Marketplace buyers’ personal data is not stored: from orders we keep only financial and product fields.

3. Encryption

• In transit: all traffic uses HTTPS with TLS 1.2 or higher.
• At rest: marketplace tokens are encrypted with AES-256-GCM, with the key stored outside the database.
• Passwords are stored only as scrypt hashes, and session tokens only as SHA-256 hashes.
• Secrets live only in server environment variables: never in the code repository, the browser or the mobile app.

4. Access control

• Least privilege: production access is restricted to the company administrator.
• Server access is via SSH with key authentication; password logins are disabled.
• Critical accounts (code repository, hosting, domain, email and payments) use two-factor authentication.
• Every API route requires an authenticated session, and each seller’s data is isolated from all others in code. Automated tests verify both rules on every change.
• Marketplace integrations request read-only permissions only.
• Third-party evaluation access is read-only, time-limited and revoked when the evaluation ends.

5. Network security

• Only HTTPS (with HTTP redirecting to it) and SSH are exposed to the internet.
• The database and the application listen only on localhost and on the private container network, behind a reverse proxy (nginx).
• Sign-in is rate-limited, and account-changing requests are origin-checked.

6. Endpoint security baseline

• Full-disk encryption.
• Automatic screen lock with password.
• Automatic operating system and security updates.
• Active malware protection (XProtect and Gatekeeper on macOS; an equivalent antivirus on other systems).
• No shared accounts.

7. Secure development and vulnerability management

• Code is kept in a private repository, and every change runs an automated test suite before reaching production.
• Dependencies are updated regularly and their security advisories are monitored.
• Code security audits are performed periodically.
• Remediation targets: critical vulnerabilities within 7 days, high within 30 days, others in the next planned maintenance.

8. Logging and monitoring

• Changes to financial records are kept in an audit trail (who, when, before and after).
• Application and server logs are kept to investigate failures and never contain passwords or tokens.
• Automatic alerts flag failures in marketplace synchronization.

9. Incident response

Owner: the company administrator. Anyone can report an incident or vulnerability to info@strawify.com.br. When an incident occurs:

• Identify and record: what happened, when, and which data and accounts were affected.
• Contain: revoke tokens and sessions, rotate secrets and block unauthorized access.
• Assess the risk to data subjects and sellers.
• Notify: affected sellers, partner marketplaces (TikTok Shop, Shopee, Mercado Livre) and, where there is relevant risk or harm, Brazil’s ANPD, within 3 business days.
• Fix the root cause and restore the service.
• Review: document the cause and the measures that prevent recurrence.

10. Retention and deletion

• When a seller disconnects a marketplace, its credentials are deleted immediately.
• When the relationship ends, that is, when the account is deleted, all of the seller’s data is permanently deleted after the 30-day grace period.
• Access, correction and deletion requests are fulfilled within 15 days.

11. Third-party providers

We use only providers required for the service (hosting, payments, sign-in and notifications), and they receive only the data they strictly need. The list is in the Privacy Policy.

12. Contact

Security and privacy: info@strawify.com.br.